The vulnerability resides in the Snort full log reader of the agent, where the function miscalculates the remaining buffer space as it processes a synthetic multi‑line input. This miscalculation can overflow a 65,280‑byte stack buffer. For an attacker controlling the log content, the overflow could crash the agent or corrupt an SEH handler on 32‑bit Windows platforms that run the agent as SYSTEM, potentially allowing local privilege escalation or arbitrary code execution if the SEH overwrite leads to execution of attacker supplied code. The flaw is type CWE-121, a stack buffer overflow, and its impact affects confidentiality, integrity, and availability of the infected system.

Vendors identified by the numbering authority include Wazuh, with the product named Wazuh. The issue affects agent versions from the first release in 1.0.0 up through 4.14.8. Upgrade to version 4.14.9 or later resolves the bug; earlier versions remain vulnerable.

The CVSS score of 6.8 indicates a medium severity. Because no EPSS data is available, the current exploitation probability cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. The attack vector requires an attacker to write crafted content into a monitored snort‑full log file; therefore the threat is limited to environments where the agent has write access to such logs and the system uses the 32‑bit Windows build running as SYSTEM. The likelihood of a successful exploit in the wild remains uncertain but could be feasible in constrained, high‑value targets.